I am working on a site and I am using MySQL. I have a file that accesses the database with a password. Right now the password is just saved in plain text in the file but as you guys should know this is not secure. What is the best way of having this be secure? Or should I just make sure the permissions are locked down on it? Obviously sites that use SQL should have a password on their SQL servers but how do they securely do so?
Forum Thread: How Do Sites Keep Their SQL Passwords?
- Hot
- Active
-
Metasploit Error: Handler Failed to Bind 40 Replies
1 day ago -
Forum Thread: How to Know if You Are a Script Kiddie? 9 Replies
2 wks ago -
Forum Thread: How to Identify and Crack Hashes 8 Replies
2 wks ago -
Forum Thread: How to Hack School Website 8 Replies
2 wks ago -
Forum Thread: Whenever I Try "Airmon-Ng Start wlan0" There's an Error? 16 Replies
3 wks ago -
Forum Thread: How to Fix 'Failed to Detect and Mount CD-ROM' Problem When Installing Kali Linux 14 Replies
3 wks ago -
Forum Thread: Awesome Keylogging Script - BeeLogger 30 Replies
4 wks ago -
Forum Thread: How to Hack Android Phone Using Same Wifi 27 Replies
1 mo ago -
Forum Thread: Complete Guide to Creating and Hosting a Phishing Page for Beginners 48 Replies
1 mo ago -
Forum Thread: Create and Use Android/Meterpreter/reverse_tcp APK with Msfvenom? 121 Replies
1 mo ago -
How to: Minecraft DoS'Ing with Python. 1 Replies
2 mo ago -
Forum Thread: HELP I Created an Apk for Hacking My Phone Using Kali Linux in Virtual Box How Can I Install That Apk on My Phone 17 Replies
2 mo ago -
Forum Thread: Tools for Beginner Hacker 3 Replies
2 mo ago -
Forum Thread: How to Embed an Android Payload in an Image? 9 Replies
3 mo ago -
Forum Thread: Metasploit reverse_tcp Handler Problem 46 Replies
3 mo ago -
Forum Thread: HACK ANDROID with KALI USING PORT FORWARDING(portmap.io) 11 Replies
3 mo ago -
Forum Thread: Fix Initramfs Problem 5 Replies
3 mo ago -
Forum Thread: Kali Wont Start, Stuck at Kali Login: 21 Replies
4 mo ago -
Forum Thread: How to View Your Child's What's App And Many More! 3 Replies
4 mo ago -
Forum Thread: Proxy Lists for Proxy Chains 1 Replies
5 mo ago
-
Steganography: How to Hide Secret Data Inside an Image or Audio File in Seconds
-
How To: Top 10 Things to Do After Installing Kali Linux
-
How to Hack Wi-Fi: Get Anyone's Wi-Fi Password Without Cracking Using Wifiphisher
-
How To: Clear the Logs & Bash History on Hacked Linux Systems to Cover Your Tracks & Remain Undetected
-
How To: Gain SSH Access to Servers by Brute-Forcing Credentials
-
How To: Check if Your Wireless Network Adapter Supports Monitor Mode & Packet Injection
-
How To: Brute-Force Nearly Any Website Login with Hatch
-
Hack Like a Pro: How to Crack Online Web Form Passwords with THC-Hydra & Burp Suite
-
How To: Spy on Traffic from a Smartphone with Wireshark
-
How To: Exploit EternalBlue on Windows Server with Metasploit
-
How To: Hack Android Using Kali (Remotely)
-
How To: Buy the Best Wireless Network Adapter for Wi-Fi Hacking in 2019
-
How To: Scan Websites for Interesting Directories & Files with Gobuster
-
How To: Use Ettercap to Intercept Passwords with ARP Spoofing
-
Hack Like a Pro: How to Hack Facebook (Facebook Password Extractor)
-
Hacker Fundamentals: The Everyman's Guide to How Network Packets Are Routed Across the Web
-
How To: Find Identifying Information from a Phone Number Using OSINT Tools
-
How To: Crack Shadow Hashes After Getting Root on a Linux System
-
How To: Dox Anyone
-
How To: Scan for Vulnerabilities on Any Website Using Nikto
8 Responses
Hi which language are you using to connect to the database? if you are using php then the best way to store your username and password would be in a seperate connection.php file it doesn't matter that it is in plain text as you cant view php code like you can html source your best way to be secure would be to make sure that the user that connects from the site only has the permissions that it needs I hope this helps
It depends on the language you're writing in. In your connection code, you should at least consider encrypting the MySQL password in the state you have saved as text (so the password its self is not human readable), and decrypt it in memory during init. Obfuscation is another simple step you can take when dealing with code that does not compile to help keep the undetermined out (for a starters, don't name your file "connection.php"). While the text of your source code is typically safe if you've locked down your environment, you never know when a new exploit may be discovered that could give someone access to the files that contain your connection string. A skilled programmer will probably still figure it out fairly easily if determined to get in... But at least the bots/script kiddies won't. Hopefully in such an event, the extra hoops will buy you enough time to change your passwords.
Thank you two. It is in python. I am thinking about having a file that only the account the scripts are running on can read it. That should help.
Yes. Also wise to lock down MySQL to run on a non standard port and only accept connections from your web server (or a private VIP if running on the same machine). All speedbumps, but buying time in case of an intruder is wise.
I already have the server itself locked down, also only allows accepting from localhost and changed the port to outside of 10,000. If you know the workings of nmap you know why.
Here is how most sites do it. They use a thing called a hash. A hash is like an encryption, but it is a one-way encryption. This means it is impossible to decrypt without brute forcing (trying every possible combination of something until you get a hash matching the one you just stole from a database, if you're a hacker). Think of it like this: 1 + 2 = 3. So sure, we know 1 + 2 and 2 + 1 both equal 3. But which combination was the original password. Hashes are like this in the sense that they cannot be decrypted. However, with this logic, both 1 + 2 and 2 + 1 could be considered to be the correct password. This is why hashes are much larger, and much more complex. So basically, the chances of two passwords producing the same hash are almost non-existent. So how does this all work? Well, when a user registers, they input a password. Your php code will then convert the plain text into a hash. For the longest time, and even today, MD5 has been used. But the most secure will be something like SHA or SHA2, but the idea is the same. So the person enters their password, the code converts it to a hash. The hash is stored in the database. When the user logs in, the password they input is converted into a hash. The same password means the same hash will be generated, so you just compare the hash made from the login password with the hash in the database. Are they the same? If so, the password is correct. This, of course, has a downside. If a user forgets their password, the ONLY WAY to fix it is to reset the password to something random, give that random password to the user (usually via email), and then tell the user to log in and immediately change their password. Also, what others have said about properly securing the databases also applies. Someone with enough computing power could use software to brute force a password from the hashes. Of course, doing so would take a VERY long time.
While that's a great first step in storing user passwords (hopefully most sites at least use a salt as well to help mitigate rainbow tables), OP was asking about how to securely store the password his/her code uses to connect to the DB in the first place.
Yes I know how to hash and yes my database does hash things.
Share Your Thoughts